Attackers Weaponize Plex2Shell Chain to Deploy Miners and Proxies
Threat actors exploited a four-flaw chain in Plex Media Server one day after disclosure, installing cryptocurrency miners and proxy tools on exposed servers.
Key points
- Attackers used the public Plex2Shell exploit chain to gain unauthorized access to Plex Media Server installations.
- The abuse resulted in the deployment of XMRig cryptocurrency miners and a Linux proxy backdoor named myawesomeproxy.
- Plex had previously shipped fixes for the four vulnerabilities, urging users to update their servers immediately.
Threat actors began exploiting the Plex2Shell vulnerability chain against internet-facing Plex Media Server installations one day after technical details and proof-of-concept code were made public, according to SecurityWeek. The attacker activity was confirmed by a researcher who monitored a honeypot system running a vulnerable version of the media server.
The exploitation occurred on October 17, shortly after the researcher observed the initial attacks. Before this date, the honeypot had only recorded reconnaissance scans and generic attempts. The researcher noted that the attackers utilized the publicly released exploit code, though they may have modified it slightly for their specific operations.
Context and Background
The Plex2Shell chain combines four distinct flaws tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These vulnerabilities allow an attacker to execute arbitrary code on an exposed server without providing valid credentials. The executed code runs with the same privileges as the Plex service itself, granting significant access to the system.
The researcher who discovered these bugs published a write-up and proof-of-concept code on October 16. This disclosure preceded the observed wild exploitation by one day. The rapid weaponization highlights the speed at which threat actors can adapt to newly disclosed security flaws.
Plex was notified of these issues on July 27. The company confirmed the vulnerabilities and awarded a bug bounty on August 4. On September 1, Plex announced that it had already shipped fixes for the flaws and asked all server owners to upgrade their software to the latest version without delay.
Who Is Affected
The attackers deployed two specific pieces of malware on the compromised honeypot. First, they installed a cryptocurrency miner built on the XMRig framework. Later that same day, a second program called myawesomeproxy appeared on the system. This tool is identified as proxy software that displays a notice stating users agree to the potential use of their internet traffic.
The researcher suggested that threat actors target Plex servers because they are often hosted on residential IP addresses. Access to residential IPs can help attackers bypass security controls when accessing corporate VPNs and email systems. This aligns with earlier reporting by SecurityWeek on October 19, which noted that attackers were chaining these flaws to install crypto miners and backdoors.
The researcher cautioned that the published indicators of compromise cover only activity seen on the specific honeypot. This means the full scope of the attack campaign may be larger than currently documented. Other exposed servers may have been targeted in similar ways without detection.
What should you do?
Server owners should verify that their Plex Media Server installations are running the latest version released by the vendor. Plex recommended in its September advisory that all users install the newest release immediately to mitigate these risks.
Administrators should monitor their systems for signs of unauthorized code execution or unexpected network traffic. The presence of cryptocurrency mining processes or unknown proxy tools can indicate a successful compromise.
Security teams should review firewall rules to ensure that Plex servers are not unnecessarily exposed to the internet. Limiting access to trusted networks reduces the likelihood of exploitation by remote attackers.
What to do and how to stay safe: Plex
- Verify that your Plex Media Server is updated to the latest version provided by the vendor to patch known vulnerabilities.
- Monitor server logs and process lists for unauthorized execution of cryptocurrency miners or proxy software.
- Restrict network access to your media server by blocking external connections unless remote access is explicitly required.
- Review firewall configurations to ensure that sensitive services are not exposed directly to the public internet.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerabilities are included in the Plex2Shell chain?
The chain includes CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which allow unauthenticated remote code execution.
When did the wild exploitation of these flaws begin?
Exploitation was observed on October 17, one day after the researcher published the proof-of-concept code on October 16.
What malware did the attackers deploy?
Attackers deployed an XMRig-based cryptocurrency miner and a Linux proxy backdoor called myawesomeproxy on the compromised servers.
